← fix library

CRITICAL Chroma: Chroma vector database open without authentication

Why it matters

Your Chroma database answers anyone. Every embedding can be read or deleted, and embeddings usually contain the raw text of your documents. Chroma runs without auth unless you configure it.

Fix it — 3 steps

1. Run it with auth: start Chroma with `CHROMA_SERVER_AUTHN_CREDENTIALS` (token provider) or put it behind an authenticating proxy.
2. If only local apps use it, do not publish the port at all: bind 127.0.0.1 or `sudo ufw deny 8000`.
3. Treat stored data as read if it was open: rotate anything sensitive embedded in it.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:8000/api/v1/collections  # should not return a collection list

References

• https://docs.trychroma.com/deployment/auth